The vulnerability arises from the FastCGI client access check in PHP's IPv6 implementation, which compares only the first 12 bytes (96 bits) of the 16-byte IPv6 address. As a result, the listen.allowed_clients setting matches on a /96 prefix instead of the exact IPv6 address. An attacker controlling an IPv6 address that shares the first 96 bits with an allowed client can bypass the access check and connect to the FastCGI endpoint, potentially gaining unauthorized access.

An attacker who can source an IPv6 address sharing the first 96 bits with an allowed client can bypass the FastCGI client access check and reach the FastCGI endpoint. This could lead to unauthorized access to the FastCGI service. The CVSS score of 6.5 (medium severity) reflects the attack vector as adjacent network with low attack complexity and no privileges required, and the impact is high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, administrators should consider restricting access to FastCGI endpoints by other means or network-level controls to mitigate unauthorized access risks.